Analysis
-
max time kernel
448s -
max time network
1172s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/10_ethereum-classic-crazypool.bat
-
Size
251B
-
MD5
5f9ddd15f6f2bc85324526714befbcb1
-
SHA1
13c6bea4bc9c54cf812a1fcd10d2787945c6291f
-
SHA256
fd2c215228870423ad0c13dfe8a155a5e2e37ad915b5cca76904d7b982beefa2
-
SHA512
7857126426c03fdc86e3ba6c7e88bf02ccdac03d92c32d72e8a264e7dc0db0ba13021ccf4822088c3deb53e939c6dc3ef42f71c89089c028974f4fbb91b1d62d
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\10_ethereum-classic-crazypool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool stratum+tcp://eu.crazypool.org:7000 -wal 0x7b9cc9270cF06889a4286221931D3a58e627F888 -worker Phoenix -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 79 -coin etc -proto 42⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger